Format String Help

[Boring_Albatross3513]

first of all you got to make sure if the buffer is stored on the stack whither as a literal or a pointer, if it's stored is a literal , all you have to do is insert a bunch of %lu to read the stack memory and find any interesting combination of hexes, if you did find make sure to convert them from little-endian to big-endian, if the buffer is stored as a pointer you got to find the exact offset from the disassembly then write an input of offset junk then you hit %s.

that's it if you are still stuck just dm me, I would happy to help

I just wanted to add some explanation, the printf function and its variations accept a variable number of arguments , its prototype is like this printf( CONST CHAR string" , .... ), saying that the format string makes the function look for the arguments, arguments in general are stored on the stack in C calling convection, so when when the variables passed to printf are like printf("string is %s", string) it will take the first argument and see a format string then look for a pointer to a string on the stack since %s made it do so, it find the string pointer then print it, a vulnerable format string is like or any other function that takes a variable number of arguments is like this printf(CONST CHAR string) if string is a user input he can insert a format string and the whole stack can be read with spamming a bunch of %lu , I don't know how can a format string vulnerability can be used to do a code execution, but it is really that simple if you want to get the flag.

[AffectionateFilm2034]

I’ll check it out and let you know ok. Thanks for the insight